payload 4.0.0-internal.2fddfc0 → 4.0.0-internal.31ba7ee

package/dist/locked-documents/config.spec.js

@@ -1,298 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { getLockedDocumentsCollection } from './config.js';
-describe('getLockedDocumentsCollection', ()=>{
-    it('should return null when no lockable collections or globals exist', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: false,
-                    fields: []
-                },
-                {
-                    slug: 'pages',
-                    lockDocuments: false,
-                    fields: []
-                }
-            ],
-            globals: [
-                {
-                    slug: 'settings',
-                    lockDocuments: false,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).toBeNull();
-    });
-    it('should return null when no auth collections exist', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'pages',
-                    lockDocuments: {
-                        duration: 600
-                    },
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).toBeNull();
-    });
-    it('should return collection config when lockable and auth collections exist', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'pages',
-                    lockDocuments: {
-                        duration: 600
-                    },
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        expect(result?.slug).toBe('payload-locked-documents');
-        expect(result?.fields).toHaveLength(3);
-        // Check document field
-        const documentField = result?.fields.find((f)=>'name' in f && f.name === 'document');
-        expect(documentField).toBeDefined();
-        expect(documentField?.type).toBe('relationship');
-        if (documentField?.type === 'relationship') {
-            expect(documentField.relationTo).toEqual([
-                'posts',
-                'pages',
-                'users'
-            ]);
-        }
-        // Check user field
-        const userField = result?.fields.find((f)=>'name' in f && f.name === 'user');
-        expect(userField).toBeDefined();
-        expect(userField?.type).toBe('relationship');
-        if (userField?.type === 'relationship') {
-            expect(userField.relationTo).toEqual([
-                'users'
-            ]);
-        }
-    });
-    it('should only include collections with lockDocuments !== false', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'pages',
-                    lockDocuments: false,
-                    fields: []
-                },
-                {
-                    slug: 'articles',
-                    // lockDocuments undefined (defaults to true)
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        const documentField = result?.fields.find((f)=>'name' in f && f.name === 'document');
-        if (documentField?.type === 'relationship') {
-            expect(documentField.relationTo).toEqual([
-                'posts',
-                'articles',
-                'users'
-            ]);
-            expect(documentField.relationTo).not.toContain('pages');
-        }
-    });
-    it('should include multiple auth collections', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                },
-                {
-                    slug: 'admins',
-                    auth: {
-                        loginWithUsername: true
-                    },
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        const userField = result?.fields.find((f)=>'name' in f && f.name === 'user');
-        if (userField?.type === 'relationship') {
-            expect(userField.relationTo).toEqual([
-                'users',
-                'admins'
-            ]);
-        }
-    });
-    it('should set lockDocuments to false on the locked-documents collection itself', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        expect(result?.lockDocuments).toBe(false);
-    });
-    it('should create collection when only globals have lockDocuments enabled', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: false,
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    lockDocuments: false,
-                    fields: []
-                }
-            ],
-            globals: [
-                {
-                    slug: 'settings',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'menu',
-                    lockDocuments: {
-                        duration: 600
-                    },
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        expect(result?.slug).toBe('payload-locked-documents');
-        // Should NOT have a document field since no lockable collections
-        const documentField = result?.fields.find((f)=>'name' in f && f.name === 'document');
-        expect(documentField).toBeUndefined();
-        // Should have globalSlug field
-        const globalSlugField = result?.fields.find((f)=>'name' in f && f.name === 'globalSlug');
-        expect(globalSlugField).toBeDefined();
-        // Should have user field
-        const userField = result?.fields.find((f)=>'name' in f && f.name === 'user');
-        expect(userField).toBeDefined();
-    });
-    it('should include document field when lockable collections exist', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                }
-            ],
-            globals: [
-                {
-                    slug: 'settings',
-                    lockDocuments: false,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        // Should have document field
-        const documentField = result?.fields.find((f)=>'name' in f && f.name === 'document');
-        expect(documentField).toBeDefined();
-        expect(documentField?.type).toBe('relationship');
-        if (documentField?.type === 'relationship') {
-            expect(documentField.relationTo).toEqual([
-                'posts',
-                'users'
-            ]);
-        }
-        // Should have globalSlug field
-        const globalSlugField = result?.fields.find((f)=>'name' in f && f.name === 'globalSlug');
-        expect(globalSlugField).toBeDefined();
-    });
-    it('should include document field when both lockable collections and globals exist', ()=>{
-        const config = {
-            collections: [
-                {
-                    slug: 'posts',
-                    lockDocuments: true,
-                    fields: []
-                },
-                {
-                    slug: 'users',
-                    auth: true,
-                    fields: []
-                }
-            ],
-            globals: [
-                {
-                    slug: 'settings',
-                    lockDocuments: true,
-                    fields: []
-                }
-            ]
-        };
-        const result = getLockedDocumentsCollection(config);
-        expect(result).not.toBeNull();
-        // Should have document field for collections
-        const documentField = result?.fields.find((f)=>'name' in f && f.name === 'document');
-        expect(documentField).toBeDefined();
-        // Should have globalSlug field for globals
-        const globalSlugField = result?.fields.find((f)=>'name' in f && f.name === 'globalSlug');
-        expect(globalSlugField).toBeDefined();
-    });
-});
-
-//# sourceMappingURL=config.spec.js.map

package/dist/locked-documents/config.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/locked-documents/config.spec.ts"],"sourcesContent":["import type { Config } from '../config/types.js'\nimport { describe, it, expect } from 'vitest'\nimport { getLockedDocumentsCollection } from './config.js'\n\ndescribe('getLockedDocumentsCollection', () => {\n  it('should return null when no lockable collections or globals exist', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: false,\n          fields: [],\n        },\n        {\n          slug: 'pages',\n          lockDocuments: false,\n          fields: [],\n        },\n      ],\n      globals: [\n        {\n          slug: 'settings',\n          lockDocuments: false,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).toBeNull()\n  })\n\n  it('should return null when no auth collections exist', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'pages',\n          lockDocuments: { duration: 600 },\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).toBeNull()\n  })\n\n  it('should return collection config when lockable and auth collections exist', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'pages',\n          lockDocuments: { duration: 600 },\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n    expect(result?.slug).toBe('payload-locked-documents')\n    expect(result?.fields).toHaveLength(3)\n\n    // Check document field\n    const documentField = result?.fields.find((f) => 'name' in f && f.name === 'document')\n    expect(documentField).toBeDefined()\n    expect(documentField?.type).toBe('relationship')\n    if (documentField?.type === 'relationship') {\n      expect(documentField.relationTo).toEqual(['posts', 'pages', 'users'])\n    }\n\n    // Check user field\n    const userField = result?.fields.find((f) => 'name' in f && f.name === 'user')\n    expect(userField).toBeDefined()\n    expect(userField?.type).toBe('relationship')\n    if (userField?.type === 'relationship') {\n      expect(userField.relationTo).toEqual(['users'])\n    }\n  })\n\n  it('should only include collections with lockDocuments !== false', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'pages',\n          lockDocuments: false,\n          fields: [],\n        },\n        {\n          slug: 'articles',\n          // lockDocuments undefined (defaults to true)\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n\n    const documentField = result?.fields.find((f) => 'name' in f && f.name === 'document')\n    if (documentField?.type === 'relationship') {\n      expect(documentField.relationTo).toEqual(['posts', 'articles', 'users'])\n      expect(documentField.relationTo).not.toContain('pages')\n    }\n  })\n\n  it('should include multiple auth collections', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n        {\n          slug: 'admins',\n          auth: { loginWithUsername: true },\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n\n    const userField = result?.fields.find((f) => 'name' in f && f.name === 'user')\n    if (userField?.type === 'relationship') {\n      expect(userField.relationTo).toEqual(['users', 'admins'])\n    }\n  })\n\n  it('should set lockDocuments to false on the locked-documents collection itself', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n    expect(result?.lockDocuments).toBe(false)\n  })\n\n  it('should create collection when only globals have lockDocuments enabled', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: false,\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          lockDocuments: false,\n          fields: [],\n        },\n      ],\n      globals: [\n        {\n          slug: 'settings',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'menu',\n          lockDocuments: { duration: 600 },\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n    expect(result?.slug).toBe('payload-locked-documents')\n\n    // Should NOT have a document field since no lockable collections\n    const documentField = result?.fields.find((f) => 'name' in f && f.name === 'document')\n    expect(documentField).toBeUndefined()\n\n    // Should have globalSlug field\n    const globalSlugField = result?.fields.find((f) => 'name' in f && f.name === 'globalSlug')\n    expect(globalSlugField).toBeDefined()\n\n    // Should have user field\n    const userField = result?.fields.find((f) => 'name' in f && f.name === 'user')\n    expect(userField).toBeDefined()\n  })\n\n  it('should include document field when lockable collections exist', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n      ],\n      globals: [\n        {\n          slug: 'settings',\n          lockDocuments: false,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n\n    // Should have document field\n    const documentField = result?.fields.find((f) => 'name' in f && f.name === 'document')\n    expect(documentField).toBeDefined()\n    expect(documentField?.type).toBe('relationship')\n    if (documentField?.type === 'relationship') {\n      expect(documentField.relationTo).toEqual(['posts', 'users'])\n    }\n\n    // Should have globalSlug field\n    const globalSlugField = result?.fields.find((f) => 'name' in f && f.name === 'globalSlug')\n    expect(globalSlugField).toBeDefined()\n  })\n\n  it('should include document field when both lockable collections and globals exist', () => {\n    const config: Config = {\n      collections: [\n        {\n          slug: 'posts',\n          lockDocuments: true,\n          fields: [],\n        },\n        {\n          slug: 'users',\n          auth: true,\n          fields: [],\n        },\n      ],\n      globals: [\n        {\n          slug: 'settings',\n          lockDocuments: true,\n          fields: [],\n        },\n      ],\n    } as Config\n\n    const result = getLockedDocumentsCollection(config)\n\n    expect(result).not.toBeNull()\n\n    // Should have document field for collections\n    const documentField = result?.fields.find((f) => 'name' in f && f.name === 'document')\n    expect(documentField).toBeDefined()\n\n    // Should have globalSlug field for globals\n    const globalSlugField = result?.fields.find((f) => 'name' in f && f.name === 'globalSlug')\n    expect(globalSlugField).toBeDefined()\n  })\n})\n"],"names":["describe","it","expect","getLockedDocumentsCollection","config","collections","slug","lockDocuments","fields","globals","result","toBeNull","duration","auth","not","toBe","toHaveLength","documentField","find","f","name","toBeDefined","type","relationTo","toEqual","userField","toContain","loginWithUsername","toBeUndefined","globalSlugField"],"mappings":"AACA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,4BAA4B,QAAQ,cAAa;AAE1DH,SAAS,gCAAgC;IACvCC,GAAG,oEAAoE;QACrE,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;aACD;YACDC,SAAS;gBACP;oBACEH,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQC,QAAQ;IACzB;IAEAV,GAAG,qDAAqD;QACtD,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNC,eAAe;wBAAEK,UAAU;oBAAI;oBAC/BJ,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQC,QAAQ;IACzB;IAEAV,GAAG,4EAA4E;QAC7E,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNC,eAAe;wBAAEK,UAAU;oBAAI;oBAC/BJ,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAC3BT,OAAOQ,QAAQJ,MAAMS,IAAI,CAAC;QAC1Bb,OAAOQ,QAAQF,QAAQQ,YAAY,CAAC;QAEpC,uBAAuB;QACvB,MAAMC,gBAAgBP,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC3ElB,OAAOe,eAAeI,WAAW;QACjCnB,OAAOe,eAAeK,MAAMP,IAAI,CAAC;QACjC,IAAIE,eAAeK,SAAS,gBAAgB;YAC1CpB,OAAOe,cAAcM,UAAU,EAAEC,OAAO,CAAC;gBAAC;gBAAS;gBAAS;aAAQ;QACtE;QAEA,mBAAmB;QACnB,MAAMC,YAAYf,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QACvElB,OAAOuB,WAAWJ,WAAW;QAC7BnB,OAAOuB,WAAWH,MAAMP,IAAI,CAAC;QAC7B,IAAIU,WAAWH,SAAS,gBAAgB;YACtCpB,OAAOuB,UAAUF,UAAU,EAAEC,OAAO,CAAC;gBAAC;aAAQ;QAChD;IACF;IAEAvB,GAAG,gEAAgE;QACjE,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACN,6CAA6C;oBAC7CE,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAE3B,MAAMM,gBAAgBP,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC3E,IAAIH,eAAeK,SAAS,gBAAgB;YAC1CpB,OAAOe,cAAcM,UAAU,EAAEC,OAAO,CAAC;gBAAC;gBAAS;gBAAY;aAAQ;YACvEtB,OAAOe,cAAcM,UAAU,EAAET,GAAG,CAACY,SAAS,CAAC;QACjD;IACF;IAEAzB,GAAG,4CAA4C;QAC7C,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;wBAAEc,mBAAmB;oBAAK;oBAChCnB,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAE3B,MAAMc,YAAYf,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QACvE,IAAIK,WAAWH,SAAS,gBAAgB;YACtCpB,OAAOuB,UAAUF,UAAU,EAAEC,OAAO,CAAC;gBAAC;gBAAS;aAAS;QAC1D;IACF;IAEAvB,GAAG,+EAA+E;QAChF,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAC3BT,OAAOQ,QAAQH,eAAeQ,IAAI,CAAC;IACrC;IAEAd,GAAG,yEAAyE;QAC1E,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNN,eAAe;oBACfC,QAAQ,EAAE;gBACZ;aACD;YACDC,SAAS;gBACP;oBACEH,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNC,eAAe;wBAAEK,UAAU;oBAAI;oBAC/BJ,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAC3BT,OAAOQ,QAAQJ,MAAMS,IAAI,CAAC;QAE1B,iEAAiE;QACjE,MAAME,gBAAgBP,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC3ElB,OAAOe,eAAeW,aAAa;QAEnC,+BAA+B;QAC/B,MAAMC,kBAAkBnB,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC7ElB,OAAO2B,iBAAiBR,WAAW;QAEnC,yBAAyB;QACzB,MAAMI,YAAYf,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QACvElB,OAAOuB,WAAWJ,WAAW;IAC/B;IAEApB,GAAG,iEAAiE;QAClE,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;aACD;YACDC,SAAS;gBACP;oBACEH,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAE3B,6BAA6B;QAC7B,MAAMM,gBAAgBP,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC3ElB,OAAOe,eAAeI,WAAW;QACjCnB,OAAOe,eAAeK,MAAMP,IAAI,CAAC;QACjC,IAAIE,eAAeK,SAAS,gBAAgB;YAC1CpB,OAAOe,cAAcM,UAAU,EAAEC,OAAO,CAAC;gBAAC;gBAAS;aAAQ;QAC7D;QAEA,+BAA+B;QAC/B,MAAMK,kBAAkBnB,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC7ElB,OAAO2B,iBAAiBR,WAAW;IACrC;IAEApB,GAAG,kFAAkF;QACnF,MAAMG,SAAiB;YACrBC,aAAa;gBACX;oBACEC,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;gBACA;oBACEF,MAAM;oBACNO,MAAM;oBACNL,QAAQ,EAAE;gBACZ;aACD;YACDC,SAAS;gBACP;oBACEH,MAAM;oBACNC,eAAe;oBACfC,QAAQ,EAAE;gBACZ;aACD;QACH;QAEA,MAAME,SAASP,6BAA6BC;QAE5CF,OAAOQ,QAAQI,GAAG,CAACH,QAAQ;QAE3B,6CAA6C;QAC7C,MAAMM,gBAAgBP,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC3ElB,OAAOe,eAAeI,WAAW;QAEjC,2CAA2C;QAC3C,MAAMQ,kBAAkBnB,QAAQF,OAAOU,KAAK,CAACC,IAAM,UAAUA,KAAKA,EAAEC,IAAI,KAAK;QAC7ElB,OAAO2B,iBAAiBR,WAAW;IACrC;AACF"}

package/dist/uploads/checkFileAccess.spec.js

@@ -1,109 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-vi.mock('../auth/executeAccess.js', ()=>({
-        executeAccess: vi.fn()
-    }));
-import { executeAccess } from '../auth/executeAccess.js';
-import { checkFileAccess } from './checkFileAccess.js';
-const makeFindOne = (result = {
-    id: '1',
-    filename: 'logo.png'
-})=>vi.fn().mockResolvedValue(result);
-const makeCollection = ()=>({
-        config: {
-            slug: 'test-media',
-            access: {
-                read: vi.fn()
-            },
-            upload: {}
-        }
-    });
-const makeReq = (findOne)=>({
-        t: vi.fn(),
-        payload: {
-            db: {
-                findOne
-            }
-        }
-    });
-describe('checkFileAccess', ()=>{
-    beforeEach(()=>{
-        vi.mocked(executeAccess).mockResolvedValue({});
-    });
-    describe('prefix filtering', ()=>{
-        it('should add prefix clause to where query when prefix is provided', async ()=>{
-            const findOne = makeFindOne();
-            const req = makeReq(findOne);
-            const collection = makeCollection();
-            await checkFileAccess({
-                collection,
-                filename: 'logo.png',
-                prefix: 'abc123',
-                req
-            });
-            const whereArg = findOne.mock.calls[0]?.[0]?.where;
-            expect(whereArg?.and).toEqual(expect.arrayContaining([
-                {
-                    prefix: {
-                        equals: 'abc123'
-                    }
-                }
-            ]));
-        });
-        it('should not add prefix clause to where query when prefix is omitted', async ()=>{
-            const findOne = makeFindOne();
-            const req = makeReq(findOne);
-            const collection = makeCollection();
-            await checkFileAccess({
-                collection,
-                filename: 'logo.png',
-                req
-            });
-            const whereArg = findOne.mock.calls[0]?.[0]?.where;
-            const hasPrefixCondition = whereArg?.and?.some((clause)=>'prefix' in clause);
-            expect(hasPrefixCondition).toBeFalsy();
-        });
-        it('should still include filename in where query when prefix is provided', async ()=>{
-            const findOne = makeFindOne();
-            const req = makeReq(findOne);
-            const collection = makeCollection();
-            await checkFileAccess({
-                collection,
-                filename: 'logo.png',
-                prefix: 'abc123',
-                req
-            });
-            const whereArg = findOne.mock.calls[0]?.[0]?.where;
-            const filenameCondition = whereArg?.and?.[0];
-            expect(filenameCondition?.or).toEqual(expect.arrayContaining([
-                {
-                    filename: {
-                        equals: 'logo.png'
-                    }
-                }
-            ]));
-        });
-        it('should throw when no doc matches the given prefix', async ()=>{
-            const findOne = makeFindOne(null);
-            const req = makeReq(findOne);
-            const collection = makeCollection();
-            await expect(checkFileAccess({
-                collection,
-                filename: 'logo.png',
-                prefix: 'nonexistent',
-                req
-            })).rejects.toThrow();
-        });
-        it('should throw when filename contains path traversal sequence', async ()=>{
-            const findOne = makeFindOne();
-            const req = makeReq(findOne);
-            const collection = makeCollection();
-            await expect(checkFileAccess({
-                collection,
-                filename: '../etc/passwd',
-                req
-            })).rejects.toThrow();
-        });
-    });
-});
-
-//# sourceMappingURL=checkFileAccess.spec.js.map

package/dist/uploads/checkFileAccess.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/uploads/checkFileAccess.spec.ts"],"sourcesContent":["import { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nvi.mock('../auth/executeAccess.js', () => ({\n  executeAccess: vi.fn(),\n}))\n\nimport { executeAccess } from '../auth/executeAccess.js'\n\nimport { checkFileAccess } from './checkFileAccess.js'\n\nconst makeFindOne = (result: unknown = { id: '1', filename: 'logo.png' }) =>\n  vi.fn().mockResolvedValue(result)\n\nconst makeCollection = (): Collection =>\n  ({\n    config: {\n      slug: 'test-media',\n      access: { read: vi.fn() },\n      upload: {},\n    },\n  }) as unknown as Collection\n\nconst makeReq = (findOne: ReturnType<typeof vi.fn>): PayloadRequest =>\n  ({\n    t: vi.fn(),\n    payload: {\n      db: { findOne },\n    },\n  }) as unknown as PayloadRequest\n\ndescribe('checkFileAccess', () => {\n  beforeEach(() => {\n    vi.mocked(executeAccess).mockResolvedValue({})\n  })\n\n  describe('prefix filtering', () => {\n    it('should add prefix clause to where query when prefix is provided', async () => {\n      const findOne = makeFindOne()\n      const req = makeReq(findOne)\n      const collection = makeCollection()\n\n      await checkFileAccess({ collection, filename: 'logo.png', prefix: 'abc123', req })\n\n      const whereArg = findOne.mock.calls[0]?.[0]?.where\n      expect(whereArg?.and).toEqual(expect.arrayContaining([{ prefix: { equals: 'abc123' } }]))\n    })\n\n    it('should not add prefix clause to where query when prefix is omitted', async () => {\n      const findOne = makeFindOne()\n      const req = makeReq(findOne)\n      const collection = makeCollection()\n\n      await checkFileAccess({ collection, filename: 'logo.png', req })\n\n      const whereArg = findOne.mock.calls[0]?.[0]?.where\n      const hasPrefixCondition = whereArg?.and?.some(\n        (clause: Record<string, unknown>) => 'prefix' in clause,\n      )\n      expect(hasPrefixCondition).toBeFalsy()\n    })\n\n    it('should still include filename in where query when prefix is provided', async () => {\n      const findOne = makeFindOne()\n      const req = makeReq(findOne)\n      const collection = makeCollection()\n\n      await checkFileAccess({ collection, filename: 'logo.png', prefix: 'abc123', req })\n\n      const whereArg = findOne.mock.calls[0]?.[0]?.where\n      const filenameCondition = whereArg?.and?.[0]\n      expect(filenameCondition?.or).toEqual(\n        expect.arrayContaining([{ filename: { equals: 'logo.png' } }]),\n      )\n    })\n\n    it('should throw when no doc matches the given prefix', async () => {\n      const findOne = makeFindOne(null)\n      const req = makeReq(findOne)\n      const collection = makeCollection()\n\n      await expect(\n        checkFileAccess({ collection, filename: 'logo.png', prefix: 'nonexistent', req }),\n      ).rejects.toThrow()\n    })\n\n    it('should throw when filename contains path traversal sequence', async () => {\n      const findOne = makeFindOne()\n      const req = makeReq(findOne)\n      const collection = makeCollection()\n\n      await expect(\n        checkFileAccess({ collection, filename: '../etc/passwd', req }),\n      ).rejects.toThrow()\n    })\n  })\n})\n"],"names":["beforeEach","describe","expect","it","vi","mock","executeAccess","fn","checkFileAccess","makeFindOne","result","id","filename","mockResolvedValue","makeCollection","config","slug","access","read","upload","makeReq","findOne","t","payload","db","mocked","req","collection","prefix","whereArg","calls","where","and","toEqual","arrayContaining","equals","hasPrefixCondition","some","clause","toBeFalsy","filenameCondition","or","rejects","toThrow"],"mappings":"AAAA,SAASA,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAK7DA,GAAGC,IAAI,CAAC,4BAA4B,IAAO,CAAA;QACzCC,eAAeF,GAAGG,EAAE;IACtB,CAAA;AAEA,SAASD,aAAa,QAAQ,2BAA0B;AAExD,SAASE,eAAe,QAAQ,uBAAsB;AAEtD,MAAMC,cAAc,CAACC,SAAkB;IAAEC,IAAI;IAAKC,UAAU;AAAW,CAAC,GACtER,GAAGG,EAAE,GAAGM,iBAAiB,CAACH;AAE5B,MAAMI,iBAAiB,IACpB,CAAA;QACCC,QAAQ;YACNC,MAAM;YACNC,QAAQ;gBAAEC,MAAMd,GAAGG,EAAE;YAAG;YACxBY,QAAQ,CAAC;QACX;IACF,CAAA;AAEF,MAAMC,UAAU,CAACC,UACd,CAAA;QACCC,GAAGlB,GAAGG,EAAE;QACRgB,SAAS;YACPC,IAAI;gBAAEH;YAAQ;QAChB;IACF,CAAA;AAEFpB,SAAS,mBAAmB;IAC1BD,WAAW;QACTI,GAAGqB,MAAM,CAACnB,eAAeO,iBAAiB,CAAC,CAAC;IAC9C;IAEAZ,SAAS,oBAAoB;QAC3BE,GAAG,mEAAmE;YACpE,MAAMkB,UAAUZ;YAChB,MAAMiB,MAAMN,QAAQC;YACpB,MAAMM,aAAab;YAEnB,MAAMN,gBAAgB;gBAAEmB;gBAAYf,UAAU;gBAAYgB,QAAQ;gBAAUF;YAAI;YAEhF,MAAMG,WAAWR,QAAQhB,IAAI,CAACyB,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAEC;YAC7C7B,OAAO2B,UAAUG,KAAKC,OAAO,CAAC/B,OAAOgC,eAAe,CAAC;gBAAC;oBAAEN,QAAQ;wBAAEO,QAAQ;oBAAS;gBAAE;aAAE;QACzF;QAEAhC,GAAG,sEAAsE;YACvE,MAAMkB,UAAUZ;YAChB,MAAMiB,MAAMN,QAAQC;YACpB,MAAMM,aAAab;YAEnB,MAAMN,gBAAgB;gBAAEmB;gBAAYf,UAAU;gBAAYc;YAAI;YAE9D,MAAMG,WAAWR,QAAQhB,IAAI,CAACyB,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAEC;YAC7C,MAAMK,qBAAqBP,UAAUG,KAAKK,KACxC,CAACC,SAAoC,YAAYA;YAEnDpC,OAAOkC,oBAAoBG,SAAS;QACtC;QAEApC,GAAG,wEAAwE;YACzE,MAAMkB,UAAUZ;YAChB,MAAMiB,MAAMN,QAAQC;YACpB,MAAMM,aAAab;YAEnB,MAAMN,gBAAgB;gBAAEmB;gBAAYf,UAAU;gBAAYgB,QAAQ;gBAAUF;YAAI;YAEhF,MAAMG,WAAWR,QAAQhB,IAAI,CAACyB,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAEC;YAC7C,MAAMS,oBAAoBX,UAAUG,KAAK,CAAC,EAAE;YAC5C9B,OAAOsC,mBAAmBC,IAAIR,OAAO,CACnC/B,OAAOgC,eAAe,CAAC;gBAAC;oBAAEtB,UAAU;wBAAEuB,QAAQ;oBAAW;gBAAE;aAAE;QAEjE;QAEAhC,GAAG,qDAAqD;YACtD,MAAMkB,UAAUZ,YAAY;YAC5B,MAAMiB,MAAMN,QAAQC;YACpB,MAAMM,aAAab;YAEnB,MAAMZ,OACJM,gBAAgB;gBAAEmB;gBAAYf,UAAU;gBAAYgB,QAAQ;gBAAeF;YAAI,IAC/EgB,OAAO,CAACC,OAAO;QACnB;QAEAxC,GAAG,+DAA+D;YAChE,MAAMkB,UAAUZ;YAChB,MAAMiB,MAAMN,QAAQC;YACpB,MAAMM,aAAab;YAEnB,MAAMZ,OACJM,gBAAgB;gBAAEmB;gBAAYf,UAAU;gBAAiBc;YAAI,IAC7DgB,OAAO,CAACC,OAAO;QACnB;IACF;AACF"}

package/dist/uploads/endpoints/getFileFromURL.d.ts

@@ -1,3 +0,0 @@
-import type { PayloadHandler } from '../../config/types.js';
-export declare const getFileFromURLHandler: PayloadHandler;
-//# sourceMappingURL=getFileFromURL.d.ts.map

package/dist/uploads/endpoints/getFileFromURL.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getFileFromURL.d.ts","sourceRoot":"","sources":["../../../src/uploads/endpoints/getFileFromURL.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgB3D,eAAO,MAAM,qBAAqB,EAAE,cAmHnC,CAAA"}

package/dist/uploads/endpoints/getFileFromURL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/uploads/endpoints/getFileFromURL.ts"],"sourcesContent":["import type { PayloadHandler } from '../../config/types.js'\n\nimport { executeAccess } from '../../auth/executeAccess.js'\nimport { APIError } from '../../errors/APIError.js'\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { getRequestCollectionWithID } from '../../utilities/getRequestEntity.js'\nimport { isURLAllowed } from '../../utilities/isURLAllowed.js'\nimport { sanitizeFilename } from '../../utilities/sanitizeFilename.js'\nimport { safeFetch } from '../safeFetch.js'\n\n// If doc id is provided, it means we are updating the doc\n// /:collectionSlug/paste-url/:doc-id?src=:fileUrl\n\n// If doc id is not provided, it means we are creating a new doc\n// /:collectionSlug/paste-url?src=:fileUrl\n\nexport const getFileFromURLHandler: PayloadHandler = async (req) => {\n  const { id, collection } = getRequestCollectionWithID(req, { optionalID: true })\n\n  if (!req.user) {\n    throw new Forbidden(req.t)\n  }\n\n  const config = collection?.config\n\n  if (!config.upload?.pasteURL) {\n    throw new APIError('Pasting from URL is not enabled for this collection.', 400)\n  }\n\n  if (id) {\n    // updating doc\n    const accessResult = await executeAccess({ req }, config.access.update)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  } else {\n    // creating doc\n    const accessResult = await executeAccess({ req }, config.access?.create)\n    if (!accessResult) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  if (!req.url) {\n    throw new APIError('Request URL is missing.', 400)\n  }\n\n  const { searchParams } = new URL(req.url)\n  const src = searchParams.get('src')\n\n  if (!src || typeof src !== 'string') {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  const hasAllowList =\n    typeof config.upload.pasteURL === 'object' && Array.isArray(config.upload.pasteURL.allowList)\n\n  let fileURL: string\n  try {\n    fileURL = new URL(src).href\n  } catch {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n    throw new APIError('The provided URL is not allowed.', 400)\n  }\n\n  let redirectCount = 0\n  const maxRedirects = 3\n  let response!: Response\n\n  while (true) {\n    if (hasAllowList && isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n      // Allow-listed URLs bypass SSRF filtering (e.g. internal/localhost CDNs)\n      response = await fetch(fileURL, {\n        headers: { 'Accept-Encoding': 'identity' },\n        redirect: 'manual',\n        signal: AbortSignal.timeout(30_000),\n      })\n    } else {\n      response = await safeFetch(fileURL, {\n        headers: {\n          'Accept-Encoding': 'identity',\n        },\n        signal: AbortSignal.timeout(30_000),\n      })\n    }\n\n    if (response.status >= 300 && response.status < 400) {\n      redirectCount++\n      if (redirectCount > maxRedirects) {\n        throw new APIError('Too many redirects.', 403)\n      }\n      const location = response.headers.get('location')\n      if (location) {\n        fileURL = new URL(location, fileURL).href\n        if (hasAllowList && !isURLAllowed(fileURL, config.upload.pasteURL.allowList)) {\n          throw new APIError('The provided URL is not allowed.', 400)\n        }\n        continue\n      }\n    }\n\n    break\n  }\n\n  if (!response.ok) {\n    throw new APIError('Failed to fetch the file from the provided URL.', response.status)\n  }\n\n  const rawFileName = decodeURIComponent(new URL(fileURL).pathname.split('/').pop() || '')\n  const safeFileName = sanitizeFilename(rawFileName)\n  const encodedFileName = encodeURIComponent(safeFileName).replace(\n    /['()]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n  // Strip quotes, backslashes, and control chars from the ASCII fallback\n  const asciiFileName = safeFileName.replace(/[\"\\\\\\r\\n]/g, '_')\n\n  const headers: Record<string, string> = {\n    'Content-Disposition': `attachment; filename=\"${asciiFileName}\"; filename*=UTF-8''${encodedFileName}`,\n    'Content-Type': response.headers.get('content-type') || 'application/octet-stream',\n  }\n\n  const contentLength = response.headers.get('content-length')\n  if (contentLength) {\n    headers['Content-Length'] = contentLength\n  }\n\n  return new Response(response.body, { headers })\n}\n"],"names":["executeAccess","APIError","Forbidden","getRequestCollectionWithID","isURLAllowed","sanitizeFilename","safeFetch","getFileFromURLHandler","req","id","collection","optionalID","user","t","config","upload","pasteURL","accessResult","access","update","create","url","searchParams","URL","src","get","hasAllowList","Array","isArray","allowList","fileURL","href","redirectCount","maxRedirects","response","fetch","headers","redirect","signal","AbortSignal","timeout","status","location","ok","rawFileName","decodeURIComponent","pathname","split","pop","safeFileName","encodedFileName","encodeURIComponent","replace","c","charCodeAt","toString","toUpperCase","asciiFileName","contentLength","Response","body"],"mappings":"AAEA,SAASA,aAAa,QAAQ,8BAA6B;AAC3D,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,SAAS,QAAQ,4BAA2B;AACrD,SAASC,0BAA0B,QAAQ,sCAAqC;AAChF,SAASC,YAAY,QAAQ,kCAAiC;AAC9D,SAASC,gBAAgB,QAAQ,sCAAqC;AACtE,SAASC,SAAS,QAAQ,kBAAiB;AAE3C,0DAA0D;AAC1D,kDAAkD;AAElD,gEAAgE;AAChE,0CAA0C;AAE1C,OAAO,MAAMC,wBAAwC,OAAOC;IAC1D,MAAM,EAAEC,EAAE,EAAEC,UAAU,EAAE,GAAGP,2BAA2BK,KAAK;QAAEG,YAAY;IAAK;IAE9E,IAAI,CAACH,IAAII,IAAI,EAAE;QACb,MAAM,IAAIV,UAAUM,IAAIK,CAAC;IAC3B;IAEA,MAAMC,SAASJ,YAAYI;IAE3B,IAAI,CAACA,OAAOC,MAAM,EAAEC,UAAU;QAC5B,MAAM,IAAIf,SAAS,wDAAwD;IAC7E;IAEA,IAAIQ,IAAI;QACN,eAAe;QACf,MAAMQ,eAAe,MAAMjB,cAAc;YAAEQ;QAAI,GAAGM,OAAOI,MAAM,CAACC,MAAM;QACtE,IAAI,CAACF,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF,OAAO;QACL,eAAe;QACf,MAAMI,eAAe,MAAMjB,cAAc;YAAEQ;QAAI,GAAGM,OAAOI,MAAM,EAAEE;QACjE,IAAI,CAACH,cAAc;YACjB,MAAM,IAAIf,UAAUM,IAAIK,CAAC;QAC3B;IACF;IAEA,IAAI,CAACL,IAAIa,GAAG,EAAE;QACZ,MAAM,IAAIpB,SAAS,2BAA2B;IAChD;IAEA,MAAM,EAAEqB,YAAY,EAAE,GAAG,IAAIC,IAAIf,IAAIa,GAAG;IACxC,MAAMG,MAAMF,aAAaG,GAAG,CAAC;IAE7B,IAAI,CAACD,OAAO,OAAOA,QAAQ,UAAU;QACnC,MAAM,IAAIvB,SAAS,mCAAmC;IACxD;IAEA,MAAMyB,eACJ,OAAOZ,OAAOC,MAAM,CAACC,QAAQ,KAAK,YAAYW,MAAMC,OAAO,CAACd,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS;IAE9F,IAAIC;IACJ,IAAI;QACFA,UAAU,IAAIP,IAAIC,KAAKO,IAAI;IAC7B,EAAE,OAAM;QACN,MAAM,IAAI9B,SAAS,mCAAmC;IACxD;IAEA,IAAIyB,gBAAgB,CAACtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;QAC5E,MAAM,IAAI5B,SAAS,oCAAoC;IACzD;IAEA,IAAI+B,gBAAgB;IACpB,MAAMC,eAAe;IACrB,IAAIC;IAEJ,MAAO,KAAM;QACX,IAAIR,gBAAgBtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;YAC3E,yEAAyE;YACzEK,WAAW,MAAMC,MAAML,SAAS;gBAC9BM,SAAS;oBAAE,mBAAmB;gBAAW;gBACzCC,UAAU;gBACVC,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF,OAAO;YACLN,WAAW,MAAM5B,UAAUwB,SAAS;gBAClCM,SAAS;oBACP,mBAAmB;gBACrB;gBACAE,QAAQC,YAAYC,OAAO,CAAC;YAC9B;QACF;QAEA,IAAIN,SAASO,MAAM,IAAI,OAAOP,SAASO,MAAM,GAAG,KAAK;YACnDT;YACA,IAAIA,gBAAgBC,cAAc;gBAChC,MAAM,IAAIhC,SAAS,uBAAuB;YAC5C;YACA,MAAMyC,WAAWR,SAASE,OAAO,CAACX,GAAG,CAAC;YACtC,IAAIiB,UAAU;gBACZZ,UAAU,IAAIP,IAAImB,UAAUZ,SAASC,IAAI;gBACzC,IAAIL,gBAAgB,CAACtB,aAAa0B,SAAShB,OAAOC,MAAM,CAACC,QAAQ,CAACa,SAAS,GAAG;oBAC5E,MAAM,IAAI5B,SAAS,oCAAoC;gBACzD;gBACA;YACF;QACF;QAEA;IACF;IAEA,IAAI,CAACiC,SAASS,EAAE,EAAE;QAChB,MAAM,IAAI1C,SAAS,mDAAmDiC,SAASO,MAAM;IACvF;IAEA,MAAMG,cAAcC,mBAAmB,IAAItB,IAAIO,SAASgB,QAAQ,CAACC,KAAK,CAAC,KAAKC,GAAG,MAAM;IACrF,MAAMC,eAAe5C,iBAAiBuC;IACtC,MAAMM,kBAAkBC,mBAAmBF,cAAcG,OAAO,CAC9D,UACA,CAACC,IAAM,CAAC,CAAC,EAAEA,EAAEC,UAAU,CAAC,GAAGC,QAAQ,CAAC,IAAIC,WAAW,IAAI;IAEzD,uEAAuE;IACvE,MAAMC,gBAAgBR,aAAaG,OAAO,CAAC,cAAc;IAEzD,MAAMhB,UAAkC;QACtC,uBAAuB,CAAC,sBAAsB,EAAEqB,cAAc,oBAAoB,EAAEP,iBAAiB;QACrG,gBAAgBhB,SAASE,OAAO,CAACX,GAAG,CAAC,mBAAmB;IAC1D;IAEA,MAAMiC,gBAAgBxB,SAASE,OAAO,CAACX,GAAG,CAAC;IAC3C,IAAIiC,eAAe;QACjBtB,OAAO,CAAC,iBAAiB,GAAGsB;IAC9B;IAEA,OAAO,IAAIC,SAASzB,SAAS0B,IAAI,EAAE;QAAExB;IAAQ;AAC/C,EAAC"}

package/dist/uploads/fetchAPI-multipart/isEligibleRequest.spec.js

@@ -1,29 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { isEligibleRequest } from './isEligibleRequest.js';
-describe('isEligibleRequest', ()=>{
-    it('should accept multipart POST requests with a body stream when content-length is absent', ()=>{
-        const formData = new FormData();
-        formData.append('file', new Blob([
-            'hello world'
-        ], {
-            type: 'text/plain'
-        }), 'hello.txt');
-        const request = new Request('http://localhost/api/upload', {
-            body: formData,
-            method: 'POST'
-        });
-        expect(request.headers.get('content-length')).toBeNull();
-        expect(isEligibleRequest(request)).toBe(true);
-    });
-    it('should reject multipart POST requests when no body is present', ()=>{
-        const request = new Request('http://localhost/api/upload', {
-            headers: {
-                'content-type': 'multipart/form-data; boundary=----test-boundary'
-            },
-            method: 'POST'
-        });
-        expect(isEligibleRequest(request)).toBe(false);
-    });
-});
-
-//# sourceMappingURL=isEligibleRequest.spec.js.map

package/dist/uploads/fetchAPI-multipart/isEligibleRequest.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/uploads/fetchAPI-multipart/isEligibleRequest.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { isEligibleRequest } from './isEligibleRequest.js'\n\ndescribe('isEligibleRequest', () => {\n  it('should accept multipart POST requests with a body stream when content-length is absent', () => {\n    const formData = new FormData()\n    formData.append('file', new Blob(['hello world'], { type: 'text/plain' }), 'hello.txt')\n\n    const request = new Request('http://localhost/api/upload', {\n      body: formData,\n      method: 'POST',\n    })\n\n    expect(request.headers.get('content-length')).toBeNull()\n    expect(isEligibleRequest(request)).toBe(true)\n  })\n\n  it('should reject multipart POST requests when no body is present', () => {\n    const request = new Request('http://localhost/api/upload', {\n      headers: {\n        'content-type': 'multipart/form-data; boundary=----test-boundary',\n      },\n      method: 'POST',\n    })\n\n    expect(isEligibleRequest(request)).toBe(false)\n  })\n})\n"],"names":["describe","expect","it","isEligibleRequest","formData","FormData","append","Blob","type","request","Request","body","method","headers","get","toBeNull","toBe"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,iBAAiB,QAAQ,yBAAwB;AAE1DH,SAAS,qBAAqB;IAC5BE,GAAG,0FAA0F;QAC3F,MAAME,WAAW,IAAIC;QACrBD,SAASE,MAAM,CAAC,QAAQ,IAAIC,KAAK;YAAC;SAAc,EAAE;YAAEC,MAAM;QAAa,IAAI;QAE3E,MAAMC,UAAU,IAAIC,QAAQ,+BAA+B;YACzDC,MAAMP;YACNQ,QAAQ;QACV;QAEAX,OAAOQ,QAAQI,OAAO,CAACC,GAAG,CAAC,mBAAmBC,QAAQ;QACtDd,OAAOE,kBAAkBM,UAAUO,IAAI,CAAC;IAC1C;IAEAd,GAAG,iEAAiE;QAClE,MAAMO,UAAU,IAAIC,QAAQ,+BAA+B;YACzDG,SAAS;gBACP,gBAAgB;YAClB;YACAD,QAAQ;QACV;QAEAX,OAAOE,kBAAkBM,UAAUO,IAAI,CAAC;IAC1C;AACF"}

package/dist/uploads/getExternalFile.d.ts

@@ -1,10 +0,0 @@
-import type { PayloadRequest } from '../types/index.js';
-import type { File, FileData, UploadConfig } from './types.js';
-type Args = {
-    data: FileData;
-    req: PayloadRequest;
-    uploadConfig: UploadConfig;
-};
-export declare const getExternalFile: ({ data, req, uploadConfig }: Args) => Promise<File>;
-export {};
-//# sourceMappingURL=getExternalFile.d.ts.map

package/dist/uploads/getExternalFile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getExternalFile.d.ts","sourceRoot":"","sources":["../../src/uploads/getExternalFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAM9D,KAAK,IAAI,GAAG;IACV,IAAI,EAAE,QAAQ,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAA;AACD,eAAO,MAAM,eAAe,GAAU,6BAA6B,IAAI,KAAG,OAAO,CAAC,IAAI,CAgGrF,CAAA"}

package/dist/uploads/getExternalFile.js

@@ -1,73 +0,0 @@
-import { APIError } from '../errors/index.js';
-import { isURLAllowed } from '../utilities/isURLAllowed.js';
-import { safeFetch } from './safeFetch.js';
-export const getExternalFile = async ({ data, req, uploadConfig })=>{
-    const { filename, url } = data;
-    let trimAuthCookies = true;
-    if (typeof url === 'string') {
-        let fileURL = url;
-        if (!url.startsWith('http')) {
-            // URL points to the same server - we can send any cookies safely to our server.
-            trimAuthCookies = false;
-            const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`;
-            fileURL = `${baseUrl}${url}`;
-        }
-        let cookies = (req.headers.get('cookie') ?? '').split(';');
-        if (trimAuthCookies) {
-            cookies = cookies.filter((cookie)=>!cookie.trim().startsWith(req.payload.config.cookiePrefix));
-        }
-        const headers = uploadConfig.externalFileHeaderFilter ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers))) : {
-            cookie: cookies.join(';')
-        };
-        let res;
-        let redirectCount = 0;
-        const maxRedirects = 3;
-        while(redirectCount <= maxRedirects){
-            const skipSafeFetch = uploadConfig.skipSafeFetch === true ? uploadConfig.skipSafeFetch : Array.isArray(uploadConfig.skipSafeFetch) && isURLAllowed(fileURL, uploadConfig.skipSafeFetch);
-            const isAllowedPasteUrl = uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && isURLAllowed(fileURL, uploadConfig.pasteURL.allowList);
-            if (skipSafeFetch || isAllowedPasteUrl) {
-                res = await fetch(fileURL, {
-                    credentials: 'include',
-                    headers,
-                    method: 'GET',
-                    redirect: 'manual'
-                });
-            } else {
-                // Default
-                res = await safeFetch(fileURL, {
-                    credentials: 'include',
-                    headers,
-                    method: 'GET'
-                });
-            }
-            if (res.status >= 300 && res.status < 400) {
-                redirectCount++;
-                if (redirectCount > maxRedirects) {
-                    throw new APIError(`Too many redirects (max ${maxRedirects})`, 403);
-                }
-                const location = res.headers.get('location');
-                if (location) {
-                    fileURL = new URL(location, fileURL).toString();
-                    if (uploadConfig.pasteURL && uploadConfig.pasteURL.allowList && !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)) {
-                        throw new APIError('Redirect target is not allowed.', 400);
-                    }
-                    continue;
-                }
-            }
-            break;
-        }
-        if (!res || !res.ok) {
-            throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status);
-        }
-        const data = await res.arrayBuffer();
-        return {
-            name: filename,
-            data: Buffer.from(data),
-            mimetype: res.headers.get('content-type') || undefined,
-            size: Number(res.headers.get('content-length')) || 0
-        };
-    }
-    throw new APIError('Invalid file url', 400);
-};
-
-//# sourceMappingURL=getExternalFile.js.map

package/dist/uploads/getExternalFile.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/uploads/getExternalFile.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { File, FileData, UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/index.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\nimport { safeFetch } from './safeFetch.js'\n\ntype Args = {\n  data: FileData\n  req: PayloadRequest\n  uploadConfig: UploadConfig\n}\nexport const getExternalFile = async ({ data, req, uploadConfig }: Args): Promise<File> => {\n  const { filename, url } = data\n\n  let trimAuthCookies = true\n  if (typeof url === 'string') {\n    let fileURL = url\n    if (!url.startsWith('http')) {\n      // URL points to the same server - we can send any cookies safely to our server.\n      trimAuthCookies = false\n      const baseUrl = req.headers.get('origin') || `${req.protocol}://${req.headers.get('host')}`\n      fileURL = `${baseUrl}${url}`\n    }\n\n    let cookies = (req.headers.get('cookie') ?? '').split(';')\n\n    if (trimAuthCookies) {\n      cookies = cookies.filter(\n        (cookie) => !cookie.trim().startsWith(req.payload.config.cookiePrefix),\n      )\n    }\n\n    const headers = uploadConfig.externalFileHeaderFilter\n      ? uploadConfig.externalFileHeaderFilter(Object.fromEntries(new Headers(req.headers)))\n      : {\n          cookie: cookies.join(';'),\n        }\n\n    let res\n    let redirectCount = 0\n    const maxRedirects = 3\n\n    while (redirectCount <= maxRedirects) {\n      const skipSafeFetch: boolean =\n        uploadConfig.skipSafeFetch === true\n          ? uploadConfig.skipSafeFetch\n          : Array.isArray(uploadConfig.skipSafeFetch) &&\n            isURLAllowed(fileURL, uploadConfig.skipSafeFetch)\n\n      const isAllowedPasteUrl: boolean | undefined =\n        uploadConfig.pasteURL &&\n        uploadConfig.pasteURL.allowList &&\n        isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n\n      if (skipSafeFetch || isAllowedPasteUrl) {\n        res = await fetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n          redirect: 'manual',\n        })\n      } else {\n        // Default\n        res = await safeFetch(fileURL, {\n          credentials: 'include',\n          headers,\n          method: 'GET',\n        })\n      }\n\n      if (res.status >= 300 && res.status < 400) {\n        redirectCount++\n        if (redirectCount > maxRedirects) {\n          throw new APIError(`Too many redirects (max ${maxRedirects})`, 403)\n        }\n        const location = res.headers.get('location')\n        if (location) {\n          fileURL = new URL(location, fileURL).toString()\n          if (\n            uploadConfig.pasteURL &&\n            uploadConfig.pasteURL.allowList &&\n            !isURLAllowed(fileURL, uploadConfig.pasteURL.allowList)\n          ) {\n            throw new APIError('Redirect target is not allowed.', 400)\n          }\n          continue\n        }\n      }\n\n      break\n    }\n\n    if (!res || !res.ok) {\n      throw new APIError(`Failed to fetch file from ${fileURL}`, res?.status)\n    }\n\n    const data = await res.arrayBuffer()\n\n    return {\n      name: filename,\n      data: Buffer.from(data),\n      mimetype: res.headers.get('content-type') || undefined!,\n      size: Number(res.headers.get('content-length')) || 0,\n    }\n  }\n\n  throw new APIError('Invalid file url', 400)\n}\n"],"names":["APIError","isURLAllowed","safeFetch","getExternalFile","data","req","uploadConfig","filename","url","trimAuthCookies","fileURL","startsWith","baseUrl","headers","get","protocol","cookies","split","filter","cookie","trim","payload","config","cookiePrefix","externalFileHeaderFilter","Object","fromEntries","Headers","join","res","redirectCount","maxRedirects","skipSafeFetch","Array","isArray","isAllowedPasteUrl","pasteURL","allowList","fetch","credentials","method","redirect","status","location","URL","toString","ok","arrayBuffer","name","Buffer","from","mimetype","undefined","size","Number"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,qBAAoB;AAC7C,SAASC,YAAY,QAAQ,+BAA8B;AAC3D,SAASC,SAAS,QAAQ,iBAAgB;AAO1C,OAAO,MAAMC,kBAAkB,OAAO,EAAEC,IAAI,EAAEC,GAAG,EAAEC,YAAY,EAAQ;IACrE,MAAM,EAAEC,QAAQ,EAAEC,GAAG,EAAE,GAAGJ;IAE1B,IAAIK,kBAAkB;IACtB,IAAI,OAAOD,QAAQ,UAAU;QAC3B,IAAIE,UAAUF;QACd,IAAI,CAACA,IAAIG,UAAU,CAAC,SAAS;YAC3B,gFAAgF;YAChFF,kBAAkB;YAClB,MAAMG,UAAUP,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,GAAGT,IAAIU,QAAQ,CAAC,GAAG,EAAEV,IAAIQ,OAAO,CAACC,GAAG,CAAC,SAAS;YAC3FJ,UAAU,GAAGE,UAAUJ,KAAK;QAC9B;QAEA,IAAIQ,UAAU,AAACX,CAAAA,IAAIQ,OAAO,CAACC,GAAG,CAAC,aAAa,EAAC,EAAGG,KAAK,CAAC;QAEtD,IAAIR,iBAAiB;YACnBO,UAAUA,QAAQE,MAAM,CACtB,CAACC,SAAW,CAACA,OAAOC,IAAI,GAAGT,UAAU,CAACN,IAAIgB,OAAO,CAACC,MAAM,CAACC,YAAY;QAEzE;QAEA,MAAMV,UAAUP,aAAakB,wBAAwB,GACjDlB,aAAakB,wBAAwB,CAACC,OAAOC,WAAW,CAAC,IAAIC,QAAQtB,IAAIQ,OAAO,MAChF;YACEM,QAAQH,QAAQY,IAAI,CAAC;QACvB;QAEJ,IAAIC;QACJ,IAAIC,gBAAgB;QACpB,MAAMC,eAAe;QAErB,MAAOD,iBAAiBC,aAAc;YACpC,MAAMC,gBACJ1B,aAAa0B,aAAa,KAAK,OAC3B1B,aAAa0B,aAAa,GAC1BC,MAAMC,OAAO,CAAC5B,aAAa0B,aAAa,KACxC/B,aAAaS,SAASJ,aAAa0B,aAAa;YAEtD,MAAMG,oBACJ7B,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/BpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS;YAEvD,IAAIL,iBAAiBG,mBAAmB;gBACtCN,MAAM,MAAMS,MAAM5B,SAAS;oBACzB6B,aAAa;oBACb1B;oBACA2B,QAAQ;oBACRC,UAAU;gBACZ;YACF,OAAO;gBACL,UAAU;gBACVZ,MAAM,MAAM3B,UAAUQ,SAAS;oBAC7B6B,aAAa;oBACb1B;oBACA2B,QAAQ;gBACV;YACF;YAEA,IAAIX,IAAIa,MAAM,IAAI,OAAOb,IAAIa,MAAM,GAAG,KAAK;gBACzCZ;gBACA,IAAIA,gBAAgBC,cAAc;oBAChC,MAAM,IAAI/B,SAAS,CAAC,wBAAwB,EAAE+B,aAAa,CAAC,CAAC,EAAE;gBACjE;gBACA,MAAMY,WAAWd,IAAIhB,OAAO,CAACC,GAAG,CAAC;gBACjC,IAAI6B,UAAU;oBACZjC,UAAU,IAAIkC,IAAID,UAAUjC,SAASmC,QAAQ;oBAC7C,IACEvC,aAAa8B,QAAQ,IACrB9B,aAAa8B,QAAQ,CAACC,SAAS,IAC/B,CAACpC,aAAaS,SAASJ,aAAa8B,QAAQ,CAACC,SAAS,GACtD;wBACA,MAAM,IAAIrC,SAAS,mCAAmC;oBACxD;oBACA;gBACF;YACF;YAEA;QACF;QAEA,IAAI,CAAC6B,OAAO,CAACA,IAAIiB,EAAE,EAAE;YACnB,MAAM,IAAI9C,SAAS,CAAC,0BAA0B,EAAEU,SAAS,EAAEmB,KAAKa;QAClE;QAEA,MAAMtC,OAAO,MAAMyB,IAAIkB,WAAW;QAElC,OAAO;YACLC,MAAMzC;YACNH,MAAM6C,OAAOC,IAAI,CAAC9C;YAClB+C,UAAUtB,IAAIhB,OAAO,CAACC,GAAG,CAAC,mBAAmBsC;YAC7CC,MAAMC,OAAOzB,IAAIhB,OAAO,CAACC,GAAG,CAAC,sBAAsB;QACrD;IACF;IAEA,MAAM,IAAId,SAAS,oBAAoB;AACzC,EAAC"}